1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
|
From: Enrico Zimuel <e.zimuel@gmail.com>
Date: Wed, 2 Sep 2015 12:21:47 +0200
Subject: [ZF2015-08] Fix null byte injection for PDO MsSql
This addresses the same issue as found in ZF2014-06, but within the PDO MsSql
adapter. Additionally, it fixes transaction tests for that adapter.
Origin: upstream, https://github.com/zendframework/zf1/commit/2ac9c30f73ec2e6235c602bed745749a551b4fe2 https://github.com/zendframework/zf1/commit/70d8aba8c525190e906c663dfdc55355f6e74416
---
library/Zend/Db/Adapter/Pdo/Abstract.php | 1 -
library/Zend/Db/Adapter/Pdo/Mssql.php | 17 +++++++++-
library/Zend/Db/Adapter/Pdo/Sqlite.php | 14 ++++++++
tests/TestConfiguration.php.dist | 5 +--
tests/Zend/Db/Adapter/Pdo/MssqlTest.php | 58 ++++++++++++--------------------
tests/Zend/Db/Adapter/Pdo/MysqlTest.php | 13 +++++--
tests/Zend/Db/Adapter/Pdo/SqliteTest.php | 11 ++++++
tests/Zend/Db/Adapter/Pdo/TestCommon.php | 10 ++++++
tests/Zend/Db/Adapter/TestCommon.php | 5 ++-
tests/Zend/Db/TestUtil/Pdo/Mssql.php | 4 ++-
10 files changed, 91 insertions(+), 47 deletions(-)
diff --git a/library/Zend/Db/Adapter/Pdo/Abstract.php b/library/Zend/Db/Adapter/Pdo/Abstract.php
index 84a76f3..e12b602 100644
--- a/library/Zend/Db/Adapter/Pdo/Abstract.php
+++ b/library/Zend/Db/Adapter/Pdo/Abstract.php
@@ -398,4 +398,3 @@ abstract class Zend_Db_Adapter_Pdo_Abstract extends Zend_Db_Adapter_Abstract
}
}
}
-
diff --git a/library/Zend/Db/Adapter/Pdo/Mssql.php b/library/Zend/Db/Adapter/Pdo/Mssql.php
index e3d8c7a..6081887 100644
--- a/library/Zend/Db/Adapter/Pdo/Mssql.php
+++ b/library/Zend/Db/Adapter/Pdo/Mssql.php
@@ -410,7 +410,7 @@ class Zend_Db_Adapter_Pdo_Mssql extends Zend_Db_Adapter_Pdo_Abstract
public function getServerVersion()
{
try {
- $stmt = $this->query("SELECT SERVERPROPERTY('productversion')");
+ $stmt = $this->query("SELECT CAST(SERVERPROPERTY('productversion') AS VARCHAR)");
$result = $stmt->fetchAll(Zend_Db::FETCH_NUM);
if (count($result)) {
return $result[0][0];
@@ -420,4 +420,19 @@ class Zend_Db_Adapter_Pdo_Mssql extends Zend_Db_Adapter_Pdo_Abstract
return null;
}
}
+
+ /**
+ * Quote a raw string.
+ *
+ * @param string $value Raw string
+ * @return string Quoted string
+ */
+ protected function _quote($value)
+ {
+ if (!is_int($value) && !is_float($value)) {
+ // Fix for null-byte injection
+ $value = addcslashes($value, "\000\032");
+ }
+ return parent::_quote($value);
+ }
}
diff --git a/library/Zend/Db/Adapter/Pdo/Sqlite.php b/library/Zend/Db/Adapter/Pdo/Sqlite.php
index f035cea..557e6ae 100644
--- a/library/Zend/Db/Adapter/Pdo/Sqlite.php
+++ b/library/Zend/Db/Adapter/Pdo/Sqlite.php
@@ -294,4 +294,18 @@ class Zend_Db_Adapter_Pdo_Sqlite extends Zend_Db_Adapter_Pdo_Abstract
return $sql;
}
+ /**
+ * Quote a raw string.
+ *
+ * @param string $value Raw string
+ * @return string Quoted string
+ */
+ protected function _quote($value)
+ {
+ if (!is_int($value) && !is_float($value)) {
+ // Fix for null-byte injection
+ $value = addcslashes($value, "\000\032");
+ }
+ return parent::_quote($value);
+ }
}
diff --git a/tests/TestConfiguration.php.dist b/tests/TestConfiguration.php.dist
index cf6c050..0f95f37 100644
--- a/tests/TestConfiguration.php.dist
+++ b/tests/TestConfiguration.php.dist
@@ -84,7 +84,7 @@ defined('TESTS_ZEND_CACHE_LIBMEMCACHED_WEIGHT') || define('TESTS_ZEND_CACHE_LIBM
/**
* Zend_Cloud online tests
*
- * You may need to provide connection details for specific adapters under their
+ * You may need to provide connection details for specific adapters under their
* specific configuration settings elsewhere in this file.
*/
defined('TESTS_ZEND_CLOUD_STORAGE_WINDOWSAZURE_CONTAINER') || define('TESTS_ZEND_CLOUD_STORAGE_WINDOWSAZURE_CONTAINER', 'simplecloudcontainer');
@@ -133,6 +133,7 @@ defined('TESTS_ZEND_DB_ADAPTER_PDO_MSSQL_HOSTNAME') || define('TESTS_ZEND_DB_ADA
defined('TESTS_ZEND_DB_ADAPTER_PDO_MSSQL_USERNAME') || define('TESTS_ZEND_DB_ADAPTER_PDO_MSSQL_USERNAME', null);
defined('TESTS_ZEND_DB_ADAPTER_PDO_MSSQL_PASSWORD') || define('TESTS_ZEND_DB_ADAPTER_PDO_MSSQL_PASSWORD', null);
defined('TESTS_ZEND_DB_ADAPTER_PDO_MSSQL_DATABASE') || define('TESTS_ZEND_DB_ADAPTER_PDO_MSSQL_DATABASE', 'test');
+defined('TESTS_ZEND_DB_ADAPTER_PDO_MSSQL_PDOTYPE') || define('TESTS_ZEND_DB_ADAPTER_PDO_MSSQL_PDOTYPE', 'dblib');
/**
* Zend_Db_Adapter_Pdo_Pgsql
@@ -331,7 +332,7 @@ defined('TESTS_ZEND_HTTP_CLIENT_HTTP_PROXY_PASS') || define('TESTS_ZEND_HTTP_CLI
/**
* Zend_Http_UserAgent tests
*
- * Location of WURFL library and config file, for testing mobile device
+ * Location of WURFL library and config file, for testing mobile device
* detection.
*/
defined('TESTS_ZEND_HTTP_USERAGENT_WURFL_LIB_DIR') || define('TESTS_ZEND_HTTP_USERAGENT_WURFL_LIB_DIR', false);
diff --git a/tests/Zend/Db/Adapter/Pdo/MssqlTest.php b/tests/Zend/Db/Adapter/Pdo/MssqlTest.php
index 402e048..1364f15 100644
--- a/tests/Zend/Db/Adapter/Pdo/MssqlTest.php
+++ b/tests/Zend/Db/Adapter/Pdo/MssqlTest.php
@@ -211,11 +211,13 @@ class Zend_Db_Adapter_Pdo_MssqlTest extends Zend_Db_Adapter_Pdo_TestCommon
$bugs = $this->_db->quoteIdentifier('zfbugs');
$bug_id = $this->_db->quoteIdentifier('bug_id');
- // notice the number of rows in connection 2
+ $dbConnection1 = $this->_db;
+
+ // notice the number of rows at beginning
$count = $this->_db->fetchOne("SELECT COUNT(*) FROM $bugs");
$this->assertEquals(4, $count, 'Expecting to see 4 rows in bugs table (step 1)');
- // start an explicit transaction in connection 1
+ // start an explicit transaction
$this->_db->beginTransaction();
// delete a row in connection 1
@@ -225,29 +227,12 @@ class Zend_Db_Adapter_Pdo_MssqlTest extends Zend_Db_Adapter_Pdo_TestCommon
);
$this->assertEquals(1, $rowsAffected);
- // we should still see all rows in connection 2
- // because the DELETE has not been committed yet
- $count = $this->_db->fetchOne("SELECT COUNT(*) FROM $bugs");
- $this->assertEquals(4, $count, 'Expecting to still see 4 rows in bugs table (step 2); perhaps Adapter is still in autocommit mode?');
-
// commit the DELETE
$this->_db->commit();
- // now we should see one fewer rows in connection 2
+ // now we should see one fewer rows
$count = $this->_db->fetchOne("SELECT COUNT(*) FROM $bugs");
$this->assertEquals(3, $count, 'Expecting to see 3 rows in bugs table after DELETE (step 3)');
-
- // delete another row in connection 1
- $rowsAffected = $this->_db->delete(
- 'zfbugs',
- "$bug_id = 2"
- );
- $this->assertEquals(1, $rowsAffected);
-
- // we should see results immediately, because
- // the db connection returns to auto-commit mode
- $count = $this->_db->fetchOne("SELECT COUNT(*) FROM $bugs");
- $this->assertEquals(2, $count);
}
public function testAdapterTransactionRollback()
@@ -255,7 +240,7 @@ class Zend_Db_Adapter_Pdo_MssqlTest extends Zend_Db_Adapter_Pdo_TestCommon
$bugs = $this->_db->quoteIdentifier('zfbugs');
$bug_id = $this->_db->quoteIdentifier('bug_id');
- // notice the number of rows in connection 2
+ // notice the number of rows at beginning
$count = $this->_db->fetchOne("SELECT COUNT(*) FROM $bugs");
$this->assertEquals(4, $count, 'Expecting to see 4 rows in bugs table (step 1)');
@@ -269,30 +254,18 @@ class Zend_Db_Adapter_Pdo_MssqlTest extends Zend_Db_Adapter_Pdo_TestCommon
);
$this->assertEquals(1, $rowsAffected);
- // we should still see all rows in connection 2
+ // we should still see 3 rows
// because the DELETE has not been committed yet
$count = $this->_db->fetchOne("SELECT COUNT(*) FROM $bugs");
- $this->assertEquals(4, $count, 'Expecting to still see 4 rows in bugs table (step 2); perhaps Adapter is still in autocommit mode?');
+ $this->assertEquals(3, $count, 'Expecting to see 3 rows in bugs table (step 2)');
// rollback the DELETE
$this->_db->rollback();
- // now we should see the same number of rows
+ // now we should see the original number of rows
// because the DELETE was rolled back
$count = $this->_db->fetchOne("SELECT COUNT(*) FROM $bugs");
- $this->assertEquals(4, $count, 'Expecting to still see 4 rows in bugs table after DELETE is rolled back (step 3)');
-
- // delete another row in connection 1
- $rowsAffected = $this->_db->delete(
- 'zfbugs',
- "$bug_id = 2"
- );
- $this->assertEquals(1, $rowsAffected);
-
- // we should see results immediately, because
- // the db connection returns to auto-commit mode
- $count = $this->_db->fetchOne("SELECT COUNT(*) FROM $bugs");
- $this->assertEquals(3, $count, 'Expecting to see 3 rows in bugs table after DELETE (step 4)');
+ $this->assertEquals(4, $count, 'Expecting to see 4 rows in bugs table after DELETE is rolled back (step 3)');
}
/**
@@ -388,6 +361,17 @@ class Zend_Db_Adapter_Pdo_MssqlTest extends Zend_Db_Adapter_Pdo_TestCommon
$this->assertArrayHasKey('product_name', $productsTableInfo);
}
+ /**
+ * test that quote() escapes null byte character
+ * in a string.
+ */
+ public function testAdapterQuoteNullByteCharacter()
+ {
+ $string = "1\0";
+ $value = $this->_db->quote($string);
+ $this->assertEquals("'1\\000'", $value);
+ }
+
public function getDriver()
{
return 'Pdo_Mssql';
diff --git a/tests/Zend/Db/Adapter/Pdo/MysqlTest.php b/tests/Zend/Db/Adapter/Pdo/MysqlTest.php
index 6c78835..5c2d623 100644
--- a/tests/Zend/Db/Adapter/Pdo/MysqlTest.php
+++ b/tests/Zend/Db/Adapter/Pdo/MysqlTest.php
@@ -315,7 +315,17 @@ class Zend_Db_Adapter_Pdo_MysqlTest extends Zend_Db_Adapter_Pdo_TestCommon
$adapter = new ZendTest_Db_Adapter_Pdo_Mysql(array('dbname' => 'foo', 'charset' => 'XYZ', 'username' => 'bar', 'password' => 'foo'));
$this->assertEquals('mysql:dbname=foo;charset=XYZ', $adapter->_dsn());
}
-
+
+ /**
+ * Test that quote() does not alter binary data
+ */
+ public function testBinaryQuoteWithNulls()
+ {
+ $binary = pack("xxx");
+ $value = $this->_db->quote($binary);
+ $this->assertEquals('\'\0\0\0\'', $value);
+ }
+
public function getDriver()
{
return 'Pdo_Mysql';
@@ -330,4 +340,3 @@ class ZendTest_Db_Adapter_Pdo_Mysql extends Zend_Db_Adapter_Pdo_Mysql
return parent::_dsn();
}
}
-
diff --git a/tests/Zend/Db/Adapter/Pdo/SqliteTest.php b/tests/Zend/Db/Adapter/Pdo/SqliteTest.php
index cbb43b2..0867947 100644
--- a/tests/Zend/Db/Adapter/Pdo/SqliteTest.php
+++ b/tests/Zend/Db/Adapter/Pdo/SqliteTest.php
@@ -247,4 +247,15 @@ class Zend_Db_Adapter_Pdo_SqliteTest extends Zend_Db_Adapter_Pdo_TestCommon
$this->assertTrue($stmt instanceof $stmtClass,
'Expecting object of type ' . $stmtClass . ', got ' . get_class($stmt));
}
+
+ /**
+ * test that quote() escapes null byte character
+ * in a string.
+ */
+ public function testAdapterQuoteNullByteCharacter()
+ {
+ $string = "1\0";
+ $value = $this->_db->quote($string);
+ $this->assertEquals("'1\\000'", $value);
+ }
}
diff --git a/tests/Zend/Db/Adapter/Pdo/TestCommon.php b/tests/Zend/Db/Adapter/Pdo/TestCommon.php
index 1fe9fcc..b0e02d3 100644
--- a/tests/Zend/Db/Adapter/Pdo/TestCommon.php
+++ b/tests/Zend/Db/Adapter/Pdo/TestCommon.php
@@ -90,4 +90,14 @@ abstract class Zend_Db_Adapter_Pdo_TestCommon extends Zend_Db_Adapter_TestCommon
$this->assertEquals(0, $affected,
"Expected exec() to return zero affected rows; got $affected");
}
+
+ /**
+ * Test for null byte injection
+ */
+ public function testAdapterQuoteNullByteCharacter()
+ {
+ $string = "1\0";
+ $value = $this->_db->quote($string);
+ $this->assertEquals("'1\\000'", $value);
+ }
}
diff --git a/tests/Zend/Db/Adapter/TestCommon.php b/tests/Zend/Db/Adapter/TestCommon.php
index 8f7cfba..e28b035 100644
--- a/tests/Zend/Db/Adapter/TestCommon.php
+++ b/tests/Zend/Db/Adapter/TestCommon.php
@@ -1561,7 +1561,7 @@ abstract class Zend_Db_Adapter_TestCommon extends Zend_Db_TestSetup
// create a second connection to the same database
$dbConnection2 = Zend_Db::factory($this->getDriver(), $this->_util->getParams());
$dbConnection2->getConnection();
-
+
// notice the number of rows in connection 2
$count = $dbConnection2->fetchOne("SELECT COUNT(*) FROM $bugs");
$this->assertEquals(4, $count, 'Expecting to see 4 rows in bugs table (step 1)');
@@ -2020,11 +2020,10 @@ abstract class Zend_Db_Adapter_TestCommon extends Zend_Db_TestSetup
// create test table using no identifier quoting
$util->createTable('charsetutf8', array(
- 'id' => 'IDENTITY',
+ 'id' => 'INTEGER NOT NULL',
'stuff' => 'VARCHAR(32)'
));
$tableName = $this->_util->getTableName('charsetutf8');
-
// insert into the table
$numRows = $db->insert($tableName, array(
'id' => 1,
diff --git a/tests/Zend/Db/TestUtil/Pdo/Mssql.php b/tests/Zend/Db/TestUtil/Pdo/Mssql.php
index fed4107..45b8ab3 100644
--- a/tests/Zend/Db/TestUtil/Pdo/Mssql.php
+++ b/tests/Zend/Db/TestUtil/Pdo/Mssql.php
@@ -45,7 +45,9 @@ class Zend_Db_TestUtil_Pdo_Mssql extends Zend_Db_TestUtil_Pdo_Common
'username' => 'TESTS_ZEND_DB_ADAPTER_PDO_MSSQL_USERNAME',
'password' => 'TESTS_ZEND_DB_ADAPTER_PDO_MSSQL_PASSWORD',
'dbname' => 'TESTS_ZEND_DB_ADAPTER_PDO_MSSQL_DATABASE',
- 'port' => 'TESTS_ZEND_DB_ADAPTER_PDO_MSSQL_PORT'
+ 'port' => 'TESTS_ZEND_DB_ADAPTER_PDO_MSSQL_PORT',
+ 'pdoType' => 'TESTS_ZEND_DB_ADAPTER_PDO_MSSQL_PDOTYPE',
+ 'charset' => 'TESTS_ZEND_DB_ADAPTER_PDO_MSSQL_CHARSET',
);
return parent::getParams($constants);
|
